Recently active topics

Known issue page(s) updated: SEARCH-8539 | IP functions might return incorrect results for invalid inputs SEARCH-9228 | DateTime functions might return numbers for `null` SEARCH-9366, SEARCH-9628 | Different `extract type=regex overwrite` behavior with and without Lakehouse SEARCH-9710 | `strftime` with `%e` doesn't work as expected in Lakehouse searches SEARCH-9995 | `dcount` might ignore an invalid `Accuracy` parameter

Senior Cribl Engineer / Security Data EngineerLocation: Charlotte, NC preferred. Candidates in New York City, Los Angeles, Southern California, and other locations may also be considered.Work Model: Flexible hybrid or remotePosition OverviewWe are seeking an experienced Senior Cribl Engineer / Security Data Engineer to develop, maintain, and optimize large-scale security-data pipelines using Cribl Stream/LogStream.The ideal candidate will have substantial hands-on experience administering Cribl, developing pipelines, onboarding security telemetry, and integrating Cribl with SIEM platforms, AWS, and enterprise security data lakes. Experience with Snowflake, Databricks, OCSF, and security-data normalization is highly desirable.This is a senior, hands-on engineering position focused on how security data is collected, processed, enriched, routed, stored, and delivered to security analytics platforms.Responsibilities Develop, implement, administer, and maintain data-processing pipelines wit

New known issue page(s) added: SEARCH-16124 | Aggregation queries with previews enabled can return an extra row

New known issue page(s) added: SEARCH-16017 | Cloned Datatypes not carrying over original Datatype schema maps

SymptomWith Datagen timestamp extraction set to auto, Timestamp anchor unset, and Length at 150:Events with eventTime within the first 150 characters show the timestamp template in _raw during Live Capture instead of the generated timestamp. Events with eventTime beyond the first 150 characters retain the original sample data timestamp in eventTime.The timestamp template should not remain in _raw. The event should either receive the generated timestamp or retain its original value when no match occurs:"eventTime":"${timestamp:%Y-%m-%dT%H:%M:%S.%LZ}"EnvironmentCribl Stream Datagen template created from sample data containing eventTime. Datagen timestamp extraction set to auto, Timestamp anchor unset, and Length 150.ResolutionNavigate to Data Routes or Pipelines. Select Import Data in the right Preview pane. Load the sample data. Select Create a Datagen File. On the resulting screen, set Timestamp type to auto. Enter \\"eventTime\\":\\" in Timestamp anchor. Leave Length at 150. Select Sa

SymptomA new worker joins a Leader, exchanges its first config sync, then disconnects after a few seconds and never comes back online. cribl.log on the worker shows:{"channel":"criblsecret","level":"error","message":"Secret decrypt failed","confType":"certificates","path":"$CRIBL_HOME/local/cribl/auth/certs/worker-cert.key","error":{"message":"error:1C800064:Provider routines::bad decrypt"}} immediately followed by:{"channel":"cribl","level":"error","message":"failed to start API server, exiting..."} The worker connects normally with TLS disabled on the worker group's API Server settings. Enabling TLS (with or without mutual TLS) reproduces the failure on every affected worker, immediately after the first bundle sync from the Leader.Note: A failed to start API server, exiting... error with ENOENT: no such file or directory, open '.../_system/worker-rootca.pem' can accompany this symptom but is usually a separate, unrelated issue — a stale ssl.caPath entry left in the worker's local cri

New known issue page(s) added: SEARCH-15495, SEARCH-16061 | Searches on v2 SmartStore Datasets run slowly and keep running after returning results

This release is heavy on Azure, with some AI help for Pipelines and more OCSF support for security data.PlatformAPI rate limiting: Protects your deployment from overload and tells integrations when to retry. Cribl MCP for Pack Pipelines: Update Pipelines inside Packs with AI help. Marketplace updates: Share Apps publicly, find Cribl-certified Apps, and control each App’s API access.StreamPipeline Builder (formerly Copilot Editor): Build Pipelines with natural language, now with OCSF 1.9 support.EdgeAzure metadata: Tag events with subscription, resource group, VM name, and region. Windows message file resolution: Get readable Windows event fields at collection.SearchOCSF mapping for Lakehouse Engine: Consistent field names across sources. Preview v2 datatype parsing: Test parsing against sample, dataset, or live data before you commit. Datadog Metrics Source: Bring Datadog v1 metrics into Cribl with a dedicated Source.LakeOutpost for Azure Storage: Use Azure BYOS without opening inbound

New known issue page(s) added: CRIBL-46216 | File Monitor Source with load balancing drops unbroken events SEARCH-15921 | Search v2 may misdecode Splunk journal stream offsets

Known issue page(s) updated: CRIBL-43375, CRIBL-44399 | Parser Function set to Auto lowers throughput and can parse the same event twice CRIBL-44852 | Load-balanced Sources fail to initialize after configuration changes in single-instance mode CRIBL-45432 | Cannot create or rename Route or Function groups CRIBL-45484 | Parser Function with Auto-Parse skips events on Nodes older than the Leader CRIBL-45661 | WEF Kerberos authentication fails for mixed-case keytab principals PLAT-15422 | Members with Read Only Permission on Cribl Insights can view Worker Group and Edge Fleet configurations PLAT-15746 | Git History modal and Version Control view truncate multi-line commit messages SAAS-20688 | Azure Blob Storage Source re-reads appended VNet and NSG flow logs

This guide shows you how to manage a Cribl deployment as code and promote changes safely from a development environment to a production environment. You define your Cribl configuration in Terraform and your CI/CD pipeline applies the changes to the right environment. The result is a repeatable dev-to-prod workflow where every change is reviewed, version-controlled, and applied automatically.What This Guide CoversYou'll set up two isolated environments, wire them to two Git branches, and automate deployments so that: Merging to the dev branch deploys your configuration to the development environment. Merging to the prod branch deploys the same configuration to the production environment. The guide walks through the Terraform configuration for a basic Cribl Stream setup, a remote Terraform backend, and a sample GitHub Actions pipeline. It closes with the day-to-day workflow you follow to move a change from development to production.This guide is written for someone who is comfortable w

SymptomWhen creating an Amazon S3 Dataset in Cribl Search, specifying an AWS Region that is not in the supported Region list causes the request to fail with HTTP 400.The API response includes keyword enum and message should be equal to one of the allowed values.This applies to any AWS Region missing from the supported list. Examples include ap-southeast-6, ap-east-2, and mx-central-1.EnvironmentCribl Search Amazon S3 Federated Dataset backed by an external S3 bucket Search REST API or Dataset configuration UIResolutionOmit the region parameter from the Dataset creation POST request. Retry the POST request. Verify that automatic region detection associates the Dataset with the intended AWS Region and bucket.Example: Region Not in the Supported ListThe following request specifies ap-southeast-6:curl --request POST --url "https://<workspaceName>-<organizationId>.cribl.cloud/api/v1/m/default_search/search/datasets" --header "Authorization: Bearer <token>" --header "Conten

Known issue page(s) updated: SAAS-20688 | Azure Blob Storage Source re-reads appended VNet and NSG flow logs

Known issue page(s) updated: SAAS-20688 | Azure Blob Storage Source re-reads appended VNet and NSG flow logs

New known issue page(s) added: SEARCH-15299 | Limits on cached Datasets are not fully honored

SymptomA Worker (or several Workers in the same group) shows what looks like three unrelated problems at the same time:One or more Destinations report backpressure, for example:{"level":"error","message":"dns lookup failed","ioType":"destination", ... "err":{"message":"getaddrinfo ENOTFOUND <destination-hostname>","code":"ENOTFOUND","syscall":"getaddrinfo"}} with recurring Sender is at capacity / Sender has too many buffers waiting for retry entries. A commit/deploy to the Worker Group gets stuck in an "updating" state for an extended period (an hour or more), while other Workers in the same group update normally within minutes. Restarting the Cribl process on the stuck Worker does not restore its connection to the Leader — in some cases the Worker drops out of the Leader's online Worker list entirely after the restart. No events are reaching the affected Destination(s) from this Worker, even though the pipeline and Destination configuration have not changed.Taken individually, e

New known issue page(s) added: CRIBL-45909 | Datadog Agent Source ignores traces from Datadog Agent 7.84 and later

SymptomWhen upgrading a self-managed Cribl Stream Leader to 4.20.0 or later, Stream Workers or Cribl Edge Nodes using the legacy criblmaster token disconnect or fail to reconnect.EnvironmentSelf-managed Cribl Stream or Cribl Edge distributed deployment. A Leader with Stream Workers or Edge Nodes using the legacy criblmaster token. A Leader upgrade to Cribl Stream 4.20.0 or later. The Leader’s effective legacy authentication token is not explicitly persisted in the configuration used by the installed version and deployment.Resolution Restore the last known-good pre-4.20 snapshot or release if the deployment is already running 4.20 and the nodes are disconnected. Verify that the Leader and affected nodes are running the pre-4.20 release. Verify that the affected Workers and Edge Nodes reconnect. Stop Cribl Stream on the Leader. Back up the Leader configuration. Identify the authoritative Leader configuration for the installed version and deployment. For a non-HA file-based de

Hi all,I'm currently testing Cribl's AWS Cloud Connections feature to onboard AWS logging sources across multiple accounts within an AWS Organization.I've followed the organization-wide deployment process: Created an Organization Root connection in Cribl. Deployed the generated CloudFormation template in the AWS Management account to establish organization-wide discovery. Successfully discovered S3 logging buckets in member accounts. Selected an existing S3 bucket and generated the integration CloudFormation template. Deployed that template in the member account (Log Archive), which successfully created the IAM ingestion role, SQS queue and associated policies. The issue:Cribl automatically generates the S3 Source's AssumeRoleArn using the Management account ID, rather than the member account ID where the IAM role was deployed.For example: Management account: 111111111111 Log Archive account: 222222222222 Actual IAM role: arn:aws:iam::222222222222:role/CriblInputRole-exampl

Known issue page(s) updated: CRIBL-31266 | Metrics with `_metric` and `_value` fields are merged into a single key-value pair CRIBL-45815 | JSON Array Event Breaker pegs Worker CPU and drops records when a JSON field exceeds 8 MB

SymptomIn the Event Breaker Ruleset rule editor, the Out tab renders an empty table for pasted or uploaded sample data. No events, no error, and no warning appear, so the rule looks broken even though it breaks events correctly on live data.The behavior occurs when the rule's Filter condition references a metadata field rather than _raw. For example:sourcetype == 'postgresql:uf'__collectible.collectorId == 'my_collector_id'Setting the Filter condition to true makes the expected broken events appear immediately in the Out tab.EnvironmentCribl Stream 4.19.2 Cribl.Cloud and self-managed. Component: Processing > Knowledge > Event Breaker Rulesets rule editor preview. Affects all Event Breaker types, including Regex and JSON Array.ResolutionThe Event Breaker itself is working. This is a preview limitation, not a rule defect. Verify the breaker logic with a temporary filter, then restore the original expression.Open Processing > Knowledge > Event Breaker Rulesets and select the r

SymptomCribl Stream Worker Processes consume most or all available memory after Suppress functions are enabled or their cache settings increase. Worker Processes restart, become unresponsive, or worker nodes become unavailable after memory pressure or an operating-system out-of-memory event.EnvironmentCribl Stream Pipeline Suppress functions Distributed deployment with multiple Worker ProcessesResolution Review each Suppress function’s filter, key expression, suppression period, cache size limit, and cleanup settings. Estimate the distinct key count for each key expression during one suppression period. Identify high-cardinality keys, such as source or destination fields with many unique values. Reduce the key cardinality when the suppression requirement allows it. Keep the default cache size limit unless required Increase the cache size incrementally in a controlled test when a larger cache is required. Disable duplicate Suppress functions that run simult

This article explains how to send OTLP data over HTTP to the Cribl OpenTelemetry Source using curl, how this differs from OpenTelemetry exporters, and how to troubleshoot common errors. It focuses on logs, but the same patterns apply to metrics and traces. OTLP HTTP vs gRPC: Endpoints and Ports Content-Type and Payload Encoding How OTel Exporters Behave vs Using curl Manually for Testing Example: Sending OTLP Logs over HTTP with curl Adding HTTPS and Authorization Troubleshooting Common HTTP OTLP Issues 501 errors: Unsupported Content-Type 400 errors: OTLP version and path mismatch TLDR; Quick Checklist OTLP HTTP vs gRPC: Endpoints and PortsThe OpenTelemetry protocol defines different conventions for HTTP and gRPC transports:HTTP OTLP Default OTLP HTTP port: 4318. You must POST to per-signal endpoints: /v1/logs /v1/metrics /v1/traces Example base URL, port, and path: http://<cribl_host>:4318/v1/logs gRPC OTLP Default OTLP gRPC port: 4317. No URL path is used (rou

I have an issue where my cloud worker nodes were unable to send data to my S3 buckets and as a result, the data backed up. The issue with the connection to S3 appears to be resolved but the nodes are still errored out:Error: Unable to write to the filesystem, disk space is low.#secondsThrottled:1.188#throttledCount:2αthrottledFirstSeen:2026-09-25T00:47:16.159ZαthrottledLatestSeen:2026-09-25T00:47:17.347Z

Known issue page(s) updated: CRIBL-45815 | JSON Array Event Breaker pegs Worker CPU and drops records when a JSON field exceeds 8 MB